| View previous topic :: View next topic |
| Author |
Message |
larcerkev
Newbie cheater
![]() Reputation: 0
Joined: 17 Aug 2012
Posts: 17
|
 Posted: Sat Aug 25, 2012 11:59 pm Post subject: Locate Array of Bytes within a process. |
 |
|
I'm trying to do this from an external .exe file, I have googled around and saw something, but I couldn't get it to work even after fiddling... Anyone have an idea how to do this?
Edit: I'm doing it in C++.
Last edited by larcerkev on Sun Aug 26, 2012 10:44 am; edited 2 times in total |
|
| Back to top |
|
 |
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Sun Aug 26, 2012 2:36 am Post subject: |
|
|
What language are you coding in? Not much anyone can help you with without that.
_________________
- Retired. |
|
| Back to top |
|
|
larcerkev
Newbie cheater
![]() Reputation: 0
Joined: 17 Aug 2012
Posts: 17
|
| Posted: Sun Aug 26, 2012 10:44 am Post subject: |
|
|
| Oh crap, I forgot to mention I'm doing this in C++. I plan to do more fiddling around tonight after my two jobs, but i doubt I'll get something working.
|
|
| Back to top |
|
|
n0 m3rcY
Cheater
![]() Reputation: 0
Joined: 18 Jun 2012
Posts: 42
|
| Posted: Mon Aug 27, 2012 12:28 am Post subject: |
|
|
Just do something like this (not actually tested code...)
| Code: |
MODULEENTRY32 GetME32(const wchar_t *ProcessName)
{
HANDLE hSnap;
PROCESSENTRY32 pe = {0};
MODULEENTRY32 me = {0};
HANDLE hMod;
hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
if (hSnap==INVALID_HANDLE_VALUE)
return me;
pe.dwSize=sizeof(pe);
if (Process32First(hSnap, &pe))
do {
hMod=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE|TH32CS_SNAPMODULE, pe.th32ProcessID);
me.dwSize = sizeof(me);
if (Module32First(hMod, &me))
do{
if(_wcsicmp(me.szModule, ProcessName) == 0)
{
CloseHandle(hMod);
CloseHandle(hSnap);
return me;
}
} while (Module32Next(hMod, &me));
} while (Process32Next(hSnap,&pe));
if(hSnap != INVALID_HANDLE_VALUE)
CloseHandle(hSnap);
if(hMod != INVALID_HANDLE_VALUE)
CloseHandle(hMod);
ZeroMemory(&me, sizeof(MODULEENTRY32));
return me;
}
DWORD_PTR Compare(byte *bpArray1, byte *bpArray2, DWORD dwSize)
{
int k;
for(k = 0; k < 1000; k++)
{
if(memcmp((void*)bpArray1[k], (void*)bpArray2, dwSize)) // if they don't match (memcmp returns 0 if true)
return false;
}
return k;
}
DWORD_PTR FindBytes(HANDLE hProcess, const wchar_t *ProcName, byte* bpAOB, DWORD dwSize)
{
byte bpBuffer[1000];
MODULEENTRY32 mE = GetME32(ProcName);
bool bFound = false;
int i = 0;
DWORD_PTR offset = 0;
while(!bFound)
{
ReadProcessMemory(hProcess, mE.modBaseAddr + i, bpBuffer, 1000, NULL);
offset = Compare(bpBuffer, bpAOB, dwSize);
if(offset != 0)
{
offset += (DWORD_PTR)mE.modBaseAddr + i;
bFound = true;
}
i += 1000;
if((DWORD_PTR)mE.modBaseAddr + i > (DWORD_PTR)mE.modBaseSize)
return 0;
}
return offset;
}
|
|
|
| Back to top |
|
|
larcerkev
Newbie cheater
![]() Reputation: 0
Joined: 17 Aug 2012
Posts: 17
|
| Posted: Mon Aug 27, 2012 9:22 pm Post subject: |
|
|
| Thanks for the reply, I kind of get what you're trying to do there, I believe I found a method that may work well by reading the memory until I find the start of the program, then I would read out 2000 bytes at a time converting them into a hex string and searching that string for the array I wanted. Increasing by 1500 bytes at a time to ensure I don't miss the array. (1500 could probably be 1950.)
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
|
| Posted: Tue Aug 28, 2012 5:53 am Post subject: |
|
|
| larcerkev wrote: | | Thanks for the reply, I kind of get what you're trying to do there, I believe I found a method that may work well by reading the memory until I find the start of the program, then I would read out 2000 bytes at a time converting them into a hex string and searching that string for the array I wanted. Increasing by 1500 bytes at a time to ensure I don't miss the array. (1500 could probably be 1950.) |
Something like this would be extremely inefficient. Doing all the extra steps to convert the data to a string and scanning that as well. You are better off sticking to comparing against the bytes as shown above. Also, you should dump based on the memory pages (VirtualQueryEx to get that info) rather then a smaller size to reduce to the number of API calls you are doing.
_________________
- Retired. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
